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IDM 30 monitors X.cl domain bank 
15 of FIG 2 to determine *tftfetfoe& a 
pattern of payments from CI to all 
resources (i.e., Rl) in IDM 30's 
domain. 



IDM 30 compares the monitored 
pattern of payments with a pre- 
determined pattern of payments to 
determine whether the difference is 
greater than a predetermined 
difference. 



IDM 30 determines that the 
../^L monitored CI is an attacker and 
sends an attack notification to 
resource manager 12 and IRPS 34. 
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IDM 30 determines that the 
•feftmonitored CI is not an 
attacker. 
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IDM 30 monitors Y exchange bank 
16 of FIG 2 to determine a 
pattern of payments received by Rl 
from all clients in any domain (i.e., 
Cl). 



IDM 30 compares the monitored 
pattern of payments with a pre- 
determined pattern of payments to 
determine whether the difference is 
greater than a predetermined 
difference. 
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IDM 30 determines that an 
attacked has occurred and 
sends an attack notification to 
resource manager 12 and IRPS 34. 



51 



IDM 30 determines that the 
no attack has occurred on Rl . 
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